SSL - Secure Sockets Layer

Related Terms

SSL (pronounced as separate letters) is short for Secure Sockets Layer.

SSL a protocol developed by Netscape for transmitting private documents via the Internet. SSL uses a cryptographic system that uses two keys to encrypt data − a public key known to everyone and a private or secret key known only to the recipient of the message.

Most Web browsers support SSL, and many websites use the protocol to obtain confidential user information, such as credit card numbers. By convention, URLs that require an SSL connection start with https: instead of http:.

Secure HTTP (S-HTTP)

Another protocol for transmitting data securely over the World Wide Web is Secure HTTP (S-HTTP). Whereas SSL creates a secure connection between a client and a server, over which any amount of data can be sent securely, S-HTTP is designed to transmit individual messages securely. SSL and S-HTTP, therefore, can be seen as complementary rather than competing technologies. Both protocols were approved by the Internet Engineering Task Force (IETF) as a standard.

SSL 3.0 Vulnerable

SSL version 3.0 is based on the 1996 draft. In 2014, the 3.0 version of SSL was considered vulnerable due to POODLE (Padding Oracle On Downgraded Legacy Encryption) attacks. These attacks allowed secure HTTP cookies or HTTP Authorization header contents to be stolen from downgraded communications. Today, SSL 3.0 is still widely deployed.

From SSL to TLS

Secure Sockets Layer (SSL) is the predecessor to Transport Layer Security (TLS). TLS is an Internet Engineering Task Force (IETF) standards track protocol that is based on the earlier SSL specifications.